How it works
Dash runs as an Agno team in coordinate mode, with a leader that routes each request to two specialists:
Schema boundaries: Company data lives in the
public schema; agent-created views and summary tables live in the dash schema. The Analyst connection uses default_transaction_read_only=on, so each transaction starts read-only. A writable role can switch a transaction to read-write, and the bundled ai role is writable. Use a separate SELECT-only role to enforce the Analyst boundary. The Engineer uses the application’s database role, and a regex-based SQLAlchemy listener blocks common writes to public. That listener is a best-effort guard, not a database privilege boundary. Use a role without public write privileges when the boundary must hold for every SQL form.
Five layers of context
Self-learning
The Analyst is instructed to retrieve knowledge and learnings before generating SQL. It can diagnose a failed query and save the fix as a learning. These tools are model-callable, so retrieval and saving depend on the model’s tool choices.
When a churn query uses the wrong filter, Dash can save the corrected
ended_at IS NULL pattern for later retrieval. When your team defines MRR as the sum of active subscriptions excluding trials, that rule can live in knowledge/business/ for later queries.
Insights you can act on
Dash reasons about what makes an answer useful. Ask “Which plan has the highest churn rate?” and you get the number, the comparison across plans, the trend behind it, and any caveats from your business rules.Run locally
Connect to the AgentOS UI
- Open os.agno.com and log in.
- Click Connect OS, choose Local, and enter
http://localhost:8000. - Click Connect.
Dash is running locally.
Deploy to Railway
Railway deployment uses.env.production to keep production credentials separate from local dev.
1
Deploy infrastructure
2
Get your JWT key
Production requires a
JWT_VERIFICATION_KEY from AgentOS. You need the Railway domain from step 1 to set this up.- Copy your Railway domain from the output of step 1 (e.g.
dash-production-xxxx.up.railway.app). - Open os.agno.com and log in.
- Click Connect OS, choose Live, and paste your Railway URL.
- Go to Settings → OS & Security and turn on Token-Based Authorization (JWT). The UI generates a key pair and shows you the public key.
- Leave
JWT_VERIFICATION_KEYunset in.env.production. Set it directly on thedashservice, preserving the PEM line breaks:
3
Push environment and redeploy
railway_env.sh reads the remaining values from .env.production and sets them on the Railway service. It is safe to run repeatedly.Dash is live on Railway.
Production operations
Database scripts must run inside Railway’s network. The internal hostnamepgvector.railway.internal is unreachable from your local machine, so SSH into the running container:
Connect to Slack
Dash can receive DMs, @mentions, and thread replies, and can post to channels proactively. Each Slack thread maps to one Dash session.- Run Dash with a public URL (ngrok locally, or your Railway domain).
- Create and install the Slack app from the manifest in
docs/SLACK_CONNECT.md. - Set
SLACK_TOKENandSLACK_SIGNING_SECRET, then restart Dash. - In Slack, confirm Event Subscriptions shows verified, then send a DM or @mention to test.
Example prompts
Try these on the sample SaaS metrics dataset:- What’s our current MRR?
- Which plan has the highest churn rate?
- Show me revenue trends by plan over the last 6 months
- Which customers are at risk of churning?
Add your own data
Dash works best when it understands how your organization talks about data:
Load or update knowledge at any time: